Networked computers and computer systems such as those connected to the Internet face an ever-present threat of infection by a variety of types of software which may be intended to or which may actually accomplish harm. These bits of malicious software may include viruses, worms, Trojan horses, spyware, bots, and other causative agents, inter alia, which may separately or collectively be generally referred to as malware.
Computer security systems are ever-evolving in attempts to better detect malware intrusions and to better enforce security policies upon detection. Existing security systems include intrusion detection policies to detect improper or questionable traffic in a computer or other communications network, and enforcement policies that are used to permit or deny certain types of network traffic in efforts to provide access control. Among the challenges faced by these and other policy driven systems is the richness or diversity of human and computer interactions, which makes it very difficult to determine how to effectively monitor computer traffic for security detection and enforcement purposes. This richness or diversity makes it especially difficult to predetermine how computer users may act in various situations, thus providing challenges to pre-establishing an effective detection or enforcement policy.